`account-readiness` check uses default AWS credentials which may be stale

Running `npx @guardian/cdk@latest account-readiness --profile workflow` gave me `SSM Parameter Readiness: ❌ Fail` even though the workflow account is all green.

It turns out that there were stale `[default]` credentials in my local `~/.aws/credentials` file. I had to delete them and get fresh workflow credentials from Janus, which finally gave me `SSM Parameter Readiness: ✅ Pass`.

Not sure how or why the default creds are generated, but it would be great for the readiness check against the matching account name (e.g.`[workflow]`) instead of the default. Also it would be helpful have a more informative error message if the credentials are invalid.

Start with the `account-readiness` CLI command and reproduce the check using `--profile workflow` and stale default credentials. Trace how the supplied profile is used for AWS credentials and how invalid credentials are reported. Done means the matching account profile is used and credential failures produce an informative error.

Written by the indexing model from the issue text.